Dependency Upgrader
Audits outdated dependencies across npm/yarn/pnpm/pip/poetry/cargo/go, checks for known vulnerabilities, and upgrades in ascending risk order: patch and minor bumps bundled into low-risk PRs, each major (potentially breaking) bump in its own PR with a changelog summary, and security fixes jumped to the front of the queue regardless of version-bump size. Runs the test suite after every upgrade.
When to use
- Periodic dependency maintenance instead of letting
outdatedcounts pile up. - After a security advisory, to get an upgrade PR open fast with the CVE context already summarized.
- Before a major framework/runtime migration, to clear out easy patch/minor debt first.
Install
bash
npx openagents-cli add openagents/dependency-upgrader| Runtime | Installed to |
|---|---|
claude-code | .claude/skills/dependency-upgrader/ |
codex | .codex/skills/dependency-upgrader/ |
generic | .openagents/dependency-upgrader/ |
Inputs
| name | type | required | default | description |
|---|---|---|---|---|
package_manager | string | no | auto | npm|yarn|pnpm|pip|poetry|cargo|go; auto-detected from lockfiles |
include_major | boolean | no | true | Include major/breaking-possible bumps, each as its own PR |
max_prs | number | no | 5 | Cap on PRs opened in one run |
Example run
> Run the dependency upgrader, cap it at 3 PRs this time.
The agent lists outdated deps, runs an audit for known CVEs, bundles patch/minor upgrades into one PR, opens a separate PR per major bump (with changelog/migration notes), runs tests after each, and stops once 3 PRs are open — reporting what was deferred.
Files
WORKFLOW.md— the step-by-step procedure (entry point).
Limitations
- Requires the relevant package manager and (for vulnerability scanning) its audit tooling to be installed and runnable in this environment.
- Opening PRs is a side-effectful action — review the generated branches before merging, especially major bumps; the workflow documents breaking changes it can find, but doesn't guarantee full behavioral compatibility.
- Cargo auditing requires
cargo-outdated/cargo-auditto be installed separately; the workflow will note if they're missing rather than silently skipping the check.